Elysia.mount(auth.handler) returns 404 for /api/auth/* but works when using explicit GET/POST routes

[pythonhubdev]

What version of Elysia is running?

1.4.27

What platform is your computer?

Darwin 25.4.0 arm64 arm

What environment are you using

Bun 1.3.10

Are you using dynamic mode?

No - new Elysia({ aot: true })

What steps can reproduce the bug?

1. Create a global Elysia app and mount services using the service pattern.

import { Elysia } from "elysia";
import { api } from "./services/api";

const app = new Elysia()
  .use(api)
  .listen(3000);

2. Create an API service with the /api prefix.

import { Elysia } from "elysia";
import { auth } from "../auth";

export const api = new Elysia({ prefix: "/api" })
  .mount(auth.handler);

3. Configure Better Auth with:

basePath: "/api/auth"

4. Start the server.

5. Call authentication endpoints.

Working endpoints:

POST /api/auth/sign-up/email
POST /api/auth/sign-in/email

These work correctly.

6. Try accessing the dashboard route:

/api/auth/dash/*

Result:

404 Not Found

7. If routes are defined explicitly instead of using mount:

export const api = new Elysia({ prefix: "/api" })
  .get("/auth/*", async ({ request }) => auth.handler(request))
  .post("/auth/*", async ({ request }) => auth.handler(request));

Then the dashboard routes work correctly:

/api/auth/dash/*

What is the expected behavior?

Expected behavior

Mounting the Better Auth handler in Elysia should expose all auth routes correctly.

With:

export const api = new Elysia({ prefix: "/api" })
  .mount(auth.handler);

and:

basePath: "/api/auth"

all routes should work, including:

/api/auth/sign-in
/api/auth/sign-up
/api/auth/session
/api/auth/dash/*

The behavior should match the manual routing approach using .get("/auth/*") and .post("/auth/*"), without returning 404 for dashboard routes.

What do you see instead?

18:49:17.107 IST GET /api/auth/dash/list-users      404 Not Found                                                                                                                                                
18:49:17.334 IST GET /api/auth/dash/config          404 Not Found                                                                                                                                                
18:49:16.767 IST GET /api/auth/dash/user-graph-data 404 Not Found

Additional information

No response

Have you try removing the node_modules and bun.lockb and try again yet?

Yes

[rafia9005]

I've submitted a fix for this issue in #1811.

The problem was in the mount(handler) implementation - when used without an explicit path on an Elysia instance with a prefix, the handler was receiving the full path including the prefix instead of having it stripped.

For example, with your setup:

const api = new Elysia({ prefix: "/api" }).mount(auth.handler)

A request to /api/auth/dash/list-users was passing /api/auth/dash/list-users to the handler, but it should pass /auth/dash/list-users (with the /api prefix stripped).

The fix ensures the prefix is properly stripped before passing the path to the mounted handler.

[pythonhubdev]

Thanks a lot @rafia9005

[rafia9005]

Thanks a lot @rafia9005

pleased to hear it 👍

[computer4000]

Analysis

Elysia.mount() uses Bun's native request handler delegation. The issue is that mount registers a catch-all route at /api/auth/*, but Bun's router may not properly propagate requests to mounted handlers when the mounted app (Better Auth) has its own internal routing.

Likely Cause

Better Auth's handler expects to receive the full URL path. When mounted at /api/auth, requests to /api/auth/dash/* should reach the handler with path /dash/*. If Elysia's mount doesn't strip the prefix, Better Auth sees /api/auth/dash/* and returns 404 because it only knows about /dash/*.

Debugging Steps

// Add logging to see what path the handler receives
.mount('/api/auth', (req) => {
  console.log('Received request:', new URL(req.url).pathname)
  return auth.handler(req)
})

If the logs show full paths like /api/auth/dash/list-users, the prefix isn't being stripped.

Workaround

Use explicit routes or a prefix-aware mount:

.all('/api/auth/*', ({ request }) => {
  // Strip prefix manually if needed
  const url = new URL(request.url)
  request.url = url.origin + url.pathname.replace('/api/auth', '')
  return auth.handler(request)
})